How it works / Depot
Scrutyn Depot
Package registry & delivery
The package you vetted is the package you get. Depot is a managed registry, proxy and cache for npm and PyPI that serves Scrutyn’s own validated, immutable copy, delivered under your policy.
Why it matters
Checking a package only helps if the bytes you install are the bytes that were checked. Depot keeps the exact file Lens screened and serves that file, instead of fetching whatever the public registry hands out on each install.
How it works
- Keeps each file once, by its content hash, and serves it only with a clean Lens verdict. Validated once, never silently replaced.
- Checks the hash on every delivery. If the upstream file for a version we already hold ever differs, we keep our copy, hold that version and raise an alarm.
- Computes the version list and
latestitself; versions removed upstream stay available to you. - Delivers from our own storage, with the same token, policy and recall checks as every other request. Waiting and blocked files are never public.
What you get
The same bytes on every machine and in CI, a record of every download, and one endpoint per ecosystem: one for npm, pnpm, Yarn and Bun, one for pip, uv and Poetry. Immutable doesn’t mean allowed forever: if new evidence turns up, Depot stops delivering that version and a recall names the devices that downloaded it.
Depot proxies and caches npm and PyPI. It isn’t a place to publish your own private packages, and it doesn’t host container images or Helm charts.
What you control
- Which devices can download, through one token per device.
- History of every download in your activity log.
- Recall alerts that name the devices that downloaded a version later found malicious.
A matching hash shows a file is unchanged, not that its code is harmless. Security model & limits
Where it sits in the flow
Your package manager asks Scrutyn
npm, pnpm, Yarn, Bun, pip, uv or Poetry sends the request with this device’s token. Your account’s policy applies from here.
Lazaretto checks age: versions younger than your window (7 days by default, 0 to 30) are left out. Lens checks the verdict: anything held or blocked is left out. A version nobody has requested yet is listed once it is old enough, and screened before its file is served.
Depot delivers our stored copy
DepotInstalls come from Scrutyn’s own copy, served only with a clean verdict and checked against its hash on every request. A stored copy is never refetched from the public registry.
You see it, and we keep watching
Every download lands in your activity log. Stored versions are re-evaluated as feeds change; if one is later found malicious, a recall tells you which devices downloaded it.
Included in every plan
Depot is part of the one Scrutyn service; there’s no separate product or price. Compare plans, or see Lazaretto and Lens.